Skip to content
Allin
Sign up · Sign in

JWT decoder

Decode a JWT, read its claims and dates, and check its HMAC signature.

Related tools

All Encoding & decoding tools →
Base64 Encoder / DecoderEncode and decode Base64 online — free.Hash generatorCompute 15 hashes (MD5, SHA-256, SHA-3, CRC-32…) of a text or a file.URL encoder / decoderEncode and decode URLs and query parameters.UUID generatorGenerate UUID v7, v4, v5, v3, v1 or v6 in bulk, in several output formats.HTML Entity Encoder / DecoderConvert text to HTML entities and back, escaping <, >, &, quotes and optionally all non-ASCII characters.UUID Validator / DecoderValidate UUIDs and decode their version, variant, and the timestamp and MAC a v1 carries.JWT GeneratorBuild and HMAC-sign a JSON Web Token in your browser — HS256, HS384 or HS512.Hex to text converterDecode a hexadecimal string back into readable text (ignores spaces and 0x prefixes).

This free JWT decoder reads a JSON Web Token and shows its header and payload in plain, readable JSON, instantly. It's the quickest way to inspect the claims inside a token, check its expiry, or debug an authentication flow.

How to use it

  1. Paste your JWT (the header.payload.signature string).
  2. Read the decoded header and payload.
  3. Check claims like exp, iat and the subject.

Frequently asked questions

What is a JWT?

A JSON Web Token is a compact, signed token used for authentication. It has three parts — header, payload and signature — separated by dots and encoded in Base64URL.

Is decoding a JWT the same as verifying it?

No. Decoding just reveals the contents — anyone can do it. Verifying checks the signature with a secret or key to prove the token is authentic and untampered. This tool decodes; it does not verify.

Is it safe to paste my token here?

Treat any token as a secret. A live production token grants whatever it was issued for, so decode expired or test tokens here and keep the live ones inside a tool you control end to end.

What are the three parts of a JWT?

The header (algorithm and type), the payload (the claims — who, what, when), and the signature that lets a server verify the first two haven't been changed.

What is JWT decoder?

Decode a JWT, read its claims and dates, and check its HMAC signature.

When would I actually use this?

Reading a payload someone sent you, embedding a small file in a config, and finding out why a query string breaks once it reaches the server.

What is the most common mistake?

Treating Base64 as a form of protection. It is an encoding, not encryption — anyone can decode it instantly, and a token pasted into a public issue is a leaked token.

How is JWT decoder different from Base64 Encoder / Decoder?

They sit next to each other but answer different questions: Base64 Encoder / Decoder is the one to open when you need it to encode and decode Base64 online — free. Pick whichever matches what you're starting from — both are free.

Is there a tool for the next step?

HTML Entity Encoder / Decoder is the closest one after this: Convert text to HTML entities and back, escaping <, >, &, quotes and optionally all non-ASCII characters.

What else is worth having open alongside it?

URL encoder / decoder and UUID Validator / Decoder — they come up in the same task often enough to be worth a second tab.

Further reading

All guides →
ExplainerWhat Is a JWT (JSON Web Token)?A JWT is a compact, signed token used to carry identity between services. Here's its three parts, how it's used for auth, and its security limits.ExplainerWhat Is Inside a JWT — and What It Does Not ProtectA JWT is signed, not encrypted. Anyone holding the token can decode the payload and read every claim in it. Here is a real token, decoded without any key, plus the three attacks the signature is supposed to stop and the one problem it cannot solve.ExplainerEscaping a String for JSON: Three Characters Are Mandatory, and One Is a TrapRFC 8259 requires exactly three things to be escaped inside a JSON string. Everything else is optional. The one that actually breaks pipelines is a lone surrogate — legal in JSON text, impossible in UTF-8, and silently replaced the moment your data is written out.GuideURL Encoding Explained: Percent-Encoding and Where It BitesPercent-encoding is decided per URL component, which is the whole source of the confusion. A slash is legal in a path and must be escaped in a query value; a space is %20 in a path and may be + in a form body. Here are the exact RFC 3986 sets, the three JavaScript functions that disagree, and the traps.ExplainerWhat Is Base64 Encoding?Base64 turns binary data into safe text. Here's what it does, why it exists, why it isn't encryption, and the size cost it adds.GuideBuilding a URL With Parameters That Survives a Copy-PasteThree encodings, one visible difference: %20 or +. The builder's form mode matches URLSearchParams byte for byte on seventeen values — but give it a base URL with a fragment and every parameter lands inside the hash, where no server sees it.